API keys, .env files and not leaking them

After this lesson you can: Keep credentials out of your repo, permanently.

First: Git and GitHub, the parts you use

Watch

• Python Tutorial: Securely Manage Passwords and API Keys with DotEnv - Corey Schafer, 17 min. Directly targets API keys and .env usage in a concise beginner-friendly Python workflow.
• Python Quick Tip: Hiding Passwords and Secret Keys in Environment Variables (Windows) - Corey Schafer, 5 min. A short focused companion on environment variables for hiding secrets from source code.

Notes

API keys, database passwords, tokens, and private certificates are credentials, not configuration you can safely commit. Your application needs them at runtime, but your repository should contain only the code that reads them, not the secret values themselves. A common pattern is to store local development secrets in a .env file, load them into environment variables, and commit a .env.example file showing the required names with fake values.

Unlock the full lesson notes, the exercises and the graded checkpoint - ₹5,000 once.